To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 46
- compare with another revision
- download diff
- download tarball
- view history from revision 46
- Committer: Teddy Hogeborn
- Date: 2008-08-04 23:38:26 UTC
- mfrom: (24.1.20 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080804233826-idy7v8x36llseue0
* network-protocol.txt: New.
* server.py (daemon): Do the double fork thing.
* server.py (daemon): Do the double fork thing.
- files added:
- network-protocol.txt
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
38
import optparse
36
import select
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
63
69
version = "1.0.3"
70
64
71
65
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
66
syslogger = logging.handlers.SysLogHandler\
67
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
68
syslogger.setFormatter(logging.Formatter\
69
('%(levelname)s: %(message)s'))
77
70
logger.addHandler(syslogger)
71
del syslogger
78
72
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
83
73
84
74
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
75
def __init__(self, value):
86
76
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
77
def __str__(self):
78
return repr(self.value)
90
79
91
80
class AvahiServiceError(AvahiError):
92
81
pass
112
101
a sensible number of times
113
102
"""
114
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 12):
117
106
self.interface = interface
118
107
self.name = name
119
self.type = servicetype
108
self.type = type
120
109
self.port = port
121
self.TXT = TXT if TXT is not None else []
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
122
114
self.domain = domain
123
115
self.host = host
124
116
self.rename_count = 0
125
self.max_renames = max_renames
126
117
def rename(self):
127
118
"""Derived from the Avahi example code"""
128
119
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
139
125
self.remove()
140
126
self.add()
141
127
self.rename_count += 1
147
133
"""Derived from the Avahi example code"""
148
134
global group
149
135
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
136
group = dbus.Interface\
137
(bus.get_object(avahi.DBUS_NAME,
152
138
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
139
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
140
group.connect_to_signal('StateChanged',
155
141
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
142
logger.debug(u"Adding service '%s' of type '%s' ...",
157
143
service.name, service.type)
158
144
group.AddService(
159
145
self.interface, # interface
170
156
# End of Avahi example code
171
157
172
158
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
159
class Client(object):
179
160
"""A representation of a client host served by this server.
180
161
Attributes:
181
name: string; from the config file, used in log messages
162
name: string; from the config file, used in log messages
182
163
fingerprint: string (40 or 32 hexadecimal digits); used to
183
164
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
165
secret: bytestring; sent verbatim (over TLS) to client
166
fqdn: string (FQDN); available for use by the checker command
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
169
timeout: datetime.timedelta(); How long from last_checked_ok
170
until this client is invalid
171
interval: datetime.timedelta(); How often to start a new checker
172
stop_hook: If set, called by stop() as stop_hook(self)
173
checker: subprocess.Popen(); a running checker process used
174
to see if the client lives.
175
'None' if no process is running.
197
176
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
177
stop_initiator_tag: - '' -
199
178
checker_callback_tag: - '' -
200
179
checker_command: string; External command which is run to check if
201
180
client lives. %() expansions are done at
202
181
runtime with vars(self) as dict, so that for
203
182
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
183
Private attibutes:
184
_timeout: Real variable for 'timeout'
185
_interval: Real variable for 'interval'
186
_timeout_milliseconds: Used when calling gobject.timeout_add()
187
_interval_milliseconds: - '' -
206
188
"""
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
189
def _set_timeout(self, timeout):
190
"Setter function for 'timeout' attribute"
191
self._timeout = timeout
192
self._timeout_milliseconds = ((self.timeout.days
193
* 24 * 60 * 60 * 1000)
194
+ (self.timeout.seconds * 1000)
195
+ (self.timeout.microseconds
196
// 1000))
197
timeout = property(lambda self: self._timeout,
198
_set_timeout)
199
del _set_timeout
200
def _set_interval(self, interval):
201
"Setter function for 'interval' attribute"
202
self._interval = interval
203
self._interval_milliseconds = ((self.interval.days
204
* 24 * 60 * 60 * 1000)
205
+ (self.interval.seconds
206
* 1000)
207
+ (self.interval.microseconds
208
// 1000))
209
interval = property(lambda self: self._interval,
210
_set_interval)
211
del _set_interval
212
def __init__(self, name = None, stop_hook=None, config={}):
221
213
"""Note: the 'checker' key in 'config' sets the
222
214
'checker_command' attribute and *not* the 'checker'
223
215
attribute."""
224
216
self.name = name
225
if config is None:
226
config = {}
227
217
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
235
218
# Uppercase and remove spaces from fingerprint for later
236
219
# comparison purposes with return value from the fingerprint()
237
220
# function
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
221
self.fingerprint = config["fingerprint"].upper()\
222
.replace(u" ", u"")
240
223
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
224
if "secret" in config:
242
225
self.secret = config["secret"].decode(u"base64")
243
226
elif "secfile" in config:
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
227
sf = open(config["secfile"])
228
self.secret = sf.read()
229
sf.close()
248
230
else:
249
231
raise TypeError(u"No secret or secfile for client %s"
250
232
% self.name)
251
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
233
self.fqdn = config.get("fqdn", "")
234
self.created = datetime.datetime.now()
255
235
self.last_checked_ok = None
256
236
self.timeout = string_to_delta(config["timeout"])
257
237
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
238
self.stop_hook = stop_hook
259
239
self.checker = None
260
240
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
241
self.stop_initiator_tag = None
262
242
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
264
265
def enable(self):
243
self.check_command = config["checker"]
244
def start(self):
266
245
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
268
246
# Schedule a new checker to be started an 'interval' from now,
269
247
# and every interval from then on.
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
248
self.checker_initiator_tag = gobject.timeout_add\
249
(self._interval_milliseconds,
250
self.start_checker)
273
251
# Also start a new checker *right now*.
274
252
self.start_checker()
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
253
# Schedule a stop() when 'timeout' has passed
254
self.stop_initiator_tag = gobject.timeout_add\
255
(self._timeout_milliseconds,
256
self.stop)
257
def stop(self):
258
"""Stop this client.
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
261
# If this client doesn't have a secret, it is already stopped.
262
if self.secret:
263
logger.info(u"Stopping client %s", self.name)
264
self.secret = None
265
else:
291
266
return False
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
267
if getattr(self, "stop_initiator_tag", False):
268
gobject.source_remove(self.stop_initiator_tag)
269
self.stop_initiator_tag = None
296
270
if getattr(self, "checker_initiator_tag", False):
297
271
gobject.source_remove(self.checker_initiator_tag)
298
272
self.checker_initiator_tag = None
299
273
self.stop_checker()
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
274
if self.stop_hook:
275
self.stop_hook(self)
307
276
# Do not run this again if called by a gobject.timeout_add
308
277
return False
309
310
278
def __del__(self):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
279
self.stop_hook = None
280
self.stop()
281
def checker_callback(self, pid, condition):
315
282
"""The checker has completed, so take appropriate actions."""
283
now = datetime.datetime.now()
316
284
self.checker_callback_tag = None
317
285
self.checker = None
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
286
if os.WIFEXITED(condition) \
287
and (os.WEXITSTATUS(condition) == 0):
324
288
logger.info(u"Checker for %(name)s succeeded",
325
289
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
290
self.last_checked_ok = now
291
gobject.source_remove(self.stop_initiator_tag)
292
self.stop_initiator_tag = gobject.timeout_add\
293
(self._timeout_milliseconds,
294
self.stop)
332
295
elif not os.WIFEXITED(condition):
333
296
logger.warning(u"Checker for %(name)s crashed?",
334
297
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
298
else:
341
299
logger.info(u"Checker for %(name)s failed",
342
300
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
366
301
def start_checker(self):
367
302
"""Start a new checker subprocess if one is not running.
368
303
If a checker already exists, leave it running and do
377
312
# is as it should be.
378
313
if self.checker is None:
379
314
try:
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
315
# In case check_command has exactly one % operator
316
command = self.check_command % self.fqdn
382
317
except TypeError:
383
318
# Escape attributes for the shell
384
319
escaped_attrs = dict((key, re.escape(str(val)))
385
320
for key, val in
386
321
vars(self).iteritems())
387
322
try:
388
command = self.checker_command % escaped_attrs
323
command = self.check_command % escaped_attrs
389
324
except TypeError, error:
390
325
logger.error(u'Could not format string "%s":'
391
u' %s', self.checker_command, error)
326
u' %s', self.check_command, error)
392
327
return True # Try again later
393
328
try:
394
329
logger.info(u"Starting checker %r for %s",
395
330
command, self.name)
396
# We don't need to redirect stdout and stderr, since
397
# in normal mode, that is already done by daemon(),
398
# and in debug mode we don't want to. (Stdin is
399
# always replaced by /dev/null.)
400
331
self.checker = subprocess.Popen(command,
401
332
close_fds=True,
402
333
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
413
except OSError, error:
334
self.checker_callback_tag = gobject.child_watch_add\
335
(self.checker.pid,
336
self.checker_callback)
337
except subprocess.OSError, error:
414
338
logger.error(u"Failed to start subprocess: %s",
415
339
error)
416
340
# Re-run this periodically if run by gobject.timeout_add
417
341
return True
418
419
342
def stop_checker(self):
420
343
"""Force the checker process, if any, to stop."""
421
344
if self.checker_callback_tag:
423
346
self.checker_callback_tag = None
424
347
if getattr(self, "checker", None) is None:
425
348
return
426
logger.debug(u"Stopping checker for %(name)s", vars(self))
349
logger.debug("Stopping checker for %(name)s", vars(self))
427
350
try:
428
351
os.kill(self.checker.pid, signal.SIGTERM)
429
352
#os.sleep(0.5)
433
356
if error.errno != errno.ESRCH: # No such process
434
357
raise
435
358
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
440
359
def still_valid(self):
441
360
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
361
now = datetime.datetime.now()
445
362
if self.last_checked_ok is None:
446
363
return now < (self.created + self.timeout)
447
364
else:
448
365
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
584
366
585
367
586
368
def peer_certificate(session):
587
369
"Return the peer's OpenPGP certificate as a bytestring"
588
370
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
371
if gnutls.library.functions.gnutls_certificate_type_get\
372
(session._c_object) \
373
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
592
374
# ...do the normal thing
593
375
return session.peer_certificate
594
376
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
377
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
378
(session._c_object, ctypes.byref(list_size))
598
379
if list_size.value == 0:
599
380
return None
600
381
cert = cert_list[0]
604
385
def fingerprint(openpgp):
605
386
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
387
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
388
datum = gnutls.library.types.gnutls_datum_t\
389
(ctypes.cast(ctypes.c_char_p(openpgp),
390
ctypes.POINTER(ctypes.c_ubyte)),
391
ctypes.c_uint(len(openpgp)))
612
392
# New empty GnuTLS certificate
613
393
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
394
gnutls.library.functions.gnutls_openpgp_crt_init\
395
(ctypes.byref(crt))
616
396
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
621
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
628
400
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
401
buffer = ctypes.create_string_buffer(20)
402
buffer_length = ctypes.c_size_t()
631
403
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
404
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
405
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
635
406
# Deinit the certificate
636
407
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
408
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
409
fpr = ctypes.string_at(buffer, buffer_length.value)
639
410
# Convert the bytestring to hexadecimal notation
640
411
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
641
412
return hex_fpr
642
413
643
414
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
415
class tcp_handler(SocketServer.BaseRequestHandler, object):
645
416
"""A TCP request handler class.
646
417
Instantiated by IPv6_TCPServer for each request to handle it.
647
418
Note: This will run in its own forked process."""
648
419
649
420
def handle(self):
650
421
logger.info(u"TCP connection from: %s",
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
422
unicode(self.client_address))
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
656
425
657
426
line = self.request.makefile().readline()
658
427
logger.debug(u"Protocol version: %r", line)
671
440
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
441
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
673
442
# "+DHE-DSS"))
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
443
priority = "NORMAL" # Fallback default, since this
444
# MUST be set.
445
if self.server.settings["priority"]:
446
priority = self.server.settings["priority"]
447
gnutls.library.functions.gnutls_priority_set_direct\
448
(session._c_object, priority, None);
679
449
680
450
try:
681
451
session.handshake()
691
461
session.bye()
692
462
return
693
463
logger.debug(u"Fingerprint: %s", fpr)
464
client = None
694
465
for c in self.server.clients:
695
466
if c.fingerprint == fpr:
696
467
client = c
697
468
break
698
else:
469
if not client:
699
470
logger.warning(u"Client not found for fingerprint: %s",
700
471
fpr)
701
472
session.bye()
708
479
vars(client))
709
480
session.bye()
710
481
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
713
482
sent_size = 0
714
483
while sent_size < len(client.secret):
715
484
sent = session.send(client.secret[sent_size:])
720
489
session.bye()
721
490
722
491
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
492
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
725
493
"""IPv6 TCP server. Accepts 'None' as address and/or port.
726
494
Attributes:
727
495
settings: Server settings
728
496
clients: Set() of Client objects
729
enabled: Boolean; whether this server is activated yet
730
497
"""
731
498
address_family = socket.AF_INET6
732
499
def __init__(self, *args, **kwargs):
736
503
if "clients" in kwargs:
737
504
self.clients = kwargs["clients"]
738
505
del kwargs["clients"]
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
506
return super(type(self), self).__init__(*args, **kwargs)
741
507
def server_bind(self):
742
508
"""This overrides the normal server_bind() function
743
509
to bind to an interface if one was specified, and also NOT to
762
528
in6addr_any = "::"
763
529
self.server_address = (in6addr_any,
764
530
self.server_address[1])
765
elif not self.server_address[1]:
531
elif self.server_address[1] is None:
766
532
self.server_address = (self.server_address[0],
767
533
0)
768
# if self.settings["interface"]:
769
# self.server_address = (self.server_address[0],
770
# 0, # port
771
# 0, # flowinfo
772
# if_nametoindex
773
# (self.settings
774
# ["interface"]))
775
return super(IPv6_TCPServer, self).server_bind()
776
def server_activate(self):
777
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
779
def enable(self):
780
self.enabled = True
534
return super(type(self), self).server_bind()
781
535
782
536
783
537
def string_to_delta(interval):
793
547
datetime.timedelta(1)
794
548
>>> string_to_delta(u'1w')
795
549
datetime.timedelta(7)
796
>>> string_to_delta('5m 30s')
797
datetime.timedelta(0, 330)
798
550
"""
799
timevalue = datetime.timedelta(0)
800
for s in interval.split():
801
try:
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
804
if suffix == u"d":
805
delta = datetime.timedelta(value)
806
elif suffix == u"s":
807
delta = datetime.timedelta(0, value)
808
elif suffix == u"m":
809
delta = datetime.timedelta(0, 0, 0, 0, value)
810
elif suffix == u"h":
811
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
812
elif suffix == u"w":
813
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
814
else:
815
raise ValueError
816
except (ValueError, IndexError):
551
try:
552
suffix=unicode(interval[-1])
553
value=int(interval[:-1])
554
if suffix == u"d":
555
delta = datetime.timedelta(value)
556
elif suffix == u"s":
557
delta = datetime.timedelta(0, value)
558
elif suffix == u"m":
559
delta = datetime.timedelta(0, 0, 0, 0, value)
560
elif suffix == u"h":
561
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
562
elif suffix == u"w":
563
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
564
else:
817
565
raise ValueError
818
timevalue += delta
819
return timevalue
566
except (ValueError, IndexError):
567
raise ValueError
568
return delta
820
569
821
570
822
571
def server_state_changed(state):
823
572
"""Derived from the Avahi example code"""
824
573
if state == avahi.SERVER_COLLISION:
825
logger.error(u"Zeroconf server name collision")
574
logger.error(u"Server name collision")
826
575
service.remove()
827
576
elif state == avahi.SERVER_RUNNING:
828
577
service.add()
830
579
831
580
def entry_group_state_changed(state, error):
832
581
"""Derived from the Avahi example code"""
833
logger.debug(u"Avahi state change: %i", state)
582
logger.debug(u"state change: %i", state)
834
583
835
584
if state == avahi.ENTRY_GROUP_ESTABLISHED:
836
logger.debug(u"Zeroconf service established.")
585
logger.debug(u"Service established.")
837
586
elif state == avahi.ENTRY_GROUP_COLLISION:
838
logger.warning(u"Zeroconf service name collision.")
587
logger.warning(u"Service name collision.")
839
588
service.rename()
840
589
elif state == avahi.ENTRY_GROUP_FAILURE:
841
logger.critical(u"Avahi: Error in group state changed %s",
590
logger.critical(u"Error in group state changed %s",
842
591
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
592
raise AvahiGroupError("State changed: %s", str(error))
844
593
845
594
def if_nametoindex(interface):
846
595
"""Call the C function if_nametoindex(), or equivalent"""
847
596
global if_nametoindex
848
597
try:
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
598
if "ctypes.util" not in sys.modules:
599
import ctypes.util
600
if_nametoindex = ctypes.cdll.LoadLibrary\
601
(ctypes.util.find_library("c")).if_nametoindex
852
602
except (OSError, AttributeError):
853
603
if "struct" not in sys.modules:
854
604
import struct
857
607
def if_nametoindex(interface):
858
608
"Get an interface index the hard way, i.e. using fcntl()"
859
609
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
610
s = socket.socket()
611
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
612
struct.pack("16s16x", interface))
613
s.close()
863
614
interface_index = struct.unpack("I", ifreq[16:20])[0]
864
615
return interface_index
865
616
return if_nametoindex(interface)
866
617
867
618
868
def daemon(nochdir = False, noclose = False):
619
def daemon(nochdir, noclose):
869
620
"""See daemon(3). Standard BSD Unix function.
870
621
This should really exist as os.daemon, but it doesn't (yet)."""
871
622
if os.fork():
889
640
890
641
891
642
def main():
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
643
global main_loop_started
644
main_loop_started = False
645
646
parser = OptionParser()
893
647
parser.add_option("-i", "--interface", type="string",
894
648
metavar="IF", help="Bind to interface IF")
895
649
parser.add_option("-a", "--address", type="string",
896
650
help="Address to listen for requests on")
897
651
parser.add_option("-p", "--port", type="int",
898
652
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
653
parser.add_option("--check", action="store_true", default=False,
900
654
help="Run self-test")
901
parser.add_option("--debug", action="store_true",
655
parser.add_option("--debug", action="store_true", default=False,
902
656
help="Debug mode; run in foreground and log to"
903
657
" terminal")
904
658
parser.add_option("--priority", type="string", help="GnuTLS"
909
663
default="/etc/mandos", metavar="DIR",
910
664
help="Directory to search for configuration"
911
665
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help=optparse.SUPPRESS_HELP)
915
options = parser.parse_args()[0]
666
(options, args) = parser.parse_args()
916
667
917
668
if options.check:
918
669
import doctest
927
678
"priority":
928
679
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
929
680
"servicename": "Mandos",
930
"use_dbus": "True",
931
681
}
932
682
933
683
# Parse config file for server-global settings
934
684
server_config = ConfigParser.SafeConfigParser(server_defaults)
935
685
del server_defaults
936
server_config.read(os.path.join(options.configdir, "mandos.conf"))
686
server_config.read(os.path.join(options.configdir, "server.conf"))
687
server_section = "server"
937
688
# Convert the SafeConfigParser object to a dict
938
server_settings = server_config.defaults()
939
# Use getboolean on the boolean config options
940
server_settings["debug"] = (server_config.getboolean
941
("DEFAULT", "debug"))
942
server_settings["use_dbus"] = (server_config.getboolean
943
("DEFAULT", "use_dbus"))
689
server_settings = dict(server_config.items(server_section))
690
# Use getboolean on the boolean config option
691
server_settings["debug"] = server_config.getboolean\
692
(server_section, "debug")
944
693
del server_config
945
694
946
695
# Override the settings from the config file with command line
947
696
# options, if set.
948
697
for option in ("interface", "address", "port", "debug",
949
"priority", "servicename", "configdir",
950
"use_dbus"):
698
"priority", "servicename", "configdir"):
951
699
value = getattr(options, option)
952
700
if value is not None:
953
701
server_settings[option] = value
954
702
del options
955
703
# Now we have our good server settings in "server_settings"
956
704
957
# For convenience
958
debug = server_settings["debug"]
959
use_dbus = server_settings["use_dbus"]
960
use_dbus = False
961
962
if not debug:
963
syslogger.setLevel(logging.WARNING)
964
console.setLevel(logging.WARNING)
965
966
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
968
('Mandos (%s): %%(levelname)s:'
969
' %%(message)s'
970
% server_settings["servicename"]))
971
972
705
# Parse config file with clients
973
706
client_defaults = { "timeout": "1h",
974
707
"interval": "5m",
975
"checker": "fping -q -- %(host)s",
976
"host": "",
708
"checker": "fping -q -- %%(fqdn)s",
977
709
}
978
710
client_config = ConfigParser.SafeConfigParser(client_defaults)
979
711
client_config.read(os.path.join(server_settings["configdir"],
980
712
"clients.conf"))
981
713
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
except KeyError:
997
try:
998
uid = pwd.getpwnam("mandos").pw_uid
999
except KeyError:
1000
try:
1001
uid = pwd.getpwnam("nobody").pw_uid
1002
except KeyError:
1003
uid = 65534
1004
try:
1005
gid = pwd.getpwnam("_mandos").pw_gid
1006
except KeyError:
1007
try:
1008
gid = pwd.getpwnam("mandos").pw_gid
1009
except KeyError:
1010
try:
1011
gid = pwd.getpwnam("nogroup").pw_gid
1012
except KeyError:
1013
gid = 65534
1014
try:
1015
os.setuid(uid)
1016
os.setgid(gid)
1017
except OSError, error:
1018
if error[0] != errno.EPERM:
1019
raise error
1020
1021
714
global service
1022
715
service = AvahiService(name = server_settings["servicename"],
1023
servicetype = "_mandos._tcp", )
716
type = "_mandos._tcp", );
1024
717
if server_settings["interface"]:
1025
service.interface = (if_nametoindex
1026
(server_settings["interface"]))
718
service.interface = if_nametoindex(server_settings["interface"])
1027
719
1028
720
global main_loop
1029
721
global bus
1032
724
DBusGMainLoop(set_as_default=True )
1033
725
main_loop = gobject.MainLoop()
1034
726
bus = dbus.SystemBus()
1035
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1036
avahi.DBUS_PATH_SERVER),
1037
avahi.DBUS_INTERFACE_SERVER)
727
server = dbus.Interface(
728
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
729
avahi.DBUS_INTERFACE_SERVER )
1038
730
# End of Avahi example code
1039
if use_dbus:
1040
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1041
bus)
731
732
debug = server_settings["debug"]
733
734
if debug:
735
console = logging.StreamHandler()
736
# console.setLevel(logging.DEBUG)
737
console.setFormatter(logging.Formatter\
738
('%(levelname)s: %(message)s'))
739
logger.addHandler(console)
740
del console
741
742
clients = Set()
743
def remove_from_clients(client):
744
clients.remove(client)
745
if not clients:
746
logger.critical(u"No clients left, exiting")
747
sys.exit()
1042
748
1043
749
clients.update(Set(Client(name = section,
750
stop_hook = remove_from_clients,
1044
751
config
1045
= dict(client_config.items(section)),
1046
use_dbus = use_dbus)
752
= dict(client_config.items(section)))
1047
753
for section in client_config.sections()))
1048
if not clients:
1049
logger.warning(u"No clients defined")
1050
1051
if debug:
1052
# Redirect stdin so all checkers get /dev/null
1053
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1054
os.dup2(null, sys.stdin.fileno())
1055
if null > 2:
1056
os.close(null)
1057
else:
1058
# No console logging
1059
logger.removeHandler(console)
1060
# Close all input and output, do double fork, etc.
1061
daemon()
1062
1063
try:
1064
pid = os.getpid()
1065
pidfile.write(str(pid) + "\n")
1066
pidfile.close()
1067
del pidfile
1068
except IOError:
1069
logger.error(u"Could not write to file %r with PID %d",
1070
pidfilename, pid)
1071
except NameError:
1072
# "pidfile" was never created
1073
pass
1074
del pidfilename
754
755
if not debug:
756
daemon(False, False)
1075
757
1076
758
def cleanup():
1077
759
"Cleanup function; run on exit"
1084
766
1085
767
while clients:
1086
768
client = clients.pop()
1087
client.disable_hook = None
1088
client.disable()
769
client.stop_hook = None
770
client.stop()
1089
771
1090
772
atexit.register(cleanup)
1091
773
1094
776
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1095
777
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1096
778
1097
if use_dbus:
1098
class MandosServer(dbus.service.Object):
1099
"""A D-Bus proxy object"""
1100
def __init__(self):
1101
dbus.service.Object.__init__(self, bus,
1102
"/Mandos")
1103
_interface = u"org.mandos_system.Mandos"
1104
1105
@dbus.service.signal(_interface, signature="oa{sv}")
1106
def ClientAdded(self, objpath, properties):
1107
"D-Bus signal"
1108
pass
1109
1110
@dbus.service.signal(_interface, signature="o")
1111
def ClientRemoved(self, objpath):
1112
"D-Bus signal"
1113
pass
1114
1115
@dbus.service.method(_interface, out_signature="ao")
1116
def GetAllClients(self):
1117
return dbus.Array(c.dbus_object_path for c in clients)
1118
1119
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1120
def GetAllClientsWithProperties(self):
1121
return dbus.Dictionary(
1122
((c.dbus_object_path, c.GetAllProperties())
1123
for c in clients),
1124
signature="oa{sv}")
1125
1126
@dbus.service.method(_interface, in_signature="o")
1127
def RemoveClient(self, object_path):
1128
for c in clients:
1129
if c.dbus_object_path == object_path:
1130
clients.remove(c)
1131
# Don't signal anything except ClientRemoved
1132
c.use_dbus = False
1133
c.disable()
1134
# Emit D-Bus signal
1135
self.ClientRemoved(object_path)
1136
return
1137
raise KeyError
1138
@dbus.service.method(_interface)
1139
def Quit(self):
1140
main_loop.quit()
1141
1142
del _interface
1143
1144
mandos_server = MandosServer()
1145
1146
779
for client in clients:
1147
if use_dbus:
1148
# Emit D-Bus signal
1149
mandos_server.ClientAdded(client.dbus_object_path,
1150
client.GetAllProperties())
1151
client.enable()
1152
1153
tcp_server.enable()
1154
tcp_server.server_activate()
1155
780
client.start()
781
782
tcp_server = IPv6_TCPServer((server_settings["address"],
783
server_settings["port"]),
784
tcp_handler,
785
settings=server_settings,
786
clients=clients)
1156
787
# Find out what port we got
1157
788
service.port = tcp_server.socket.getsockname()[1]
1158
789
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1172
803
1173
804
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1174
805
lambda *args, **kwargs:
1175
(tcp_server.handle_request
1176
(*args[2:], **kwargs) or True))
806
tcp_server.handle_request\
807
(*args[2:], **kwargs) or True)
1177
808
1178
logger.debug(u"Starting main loop")
809
logger.debug("Starting main loop")
810
main_loop_started = True
1179
811
main_loop.run()
1180
812
except AvahiError, error:
1181
logger.critical(u"AvahiError: %s", error)
813
logger.critical(u"AvahiError: %s" + unicode(error))
1182
814
sys.exit(1)
1183
815
except KeyboardInterrupt:
1184
816
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0